Technology
Asos breach exposed detailed customer profiles, including searches and dates of birth
Asos says hackers obtained detailed profiles of potentially millions of customers, including names, addresses, phone numbers, email addresses, customer numbers, dates of birth and website searches. The disclosure followed BBC reporting based on a sample of stolen data. Asos says passwords and bank details were not accessed, but the exposed information could support convincing phishing and impersonation attempts. The company attributes the intrusion to credentials obtained by impersonating a trusted contact and says its investigation continues.
Editorial summary · Publisher article
What matters
- The stolen profiles include customer contact details, dates of birth and searches made on Asos.
- Asos says no passwords or bank details were accessed.
- Attackers reportedly obtained employee credentials through impersonation and used them to download customer data.
- The breach may increase the risk of targeted phishing and impersonation scams.
Context & caveats
- Asos has not disclosed the scale of the breach, and the alleged role of the Simon AI platform remains unverified.
Why this made the edition
BBC reporting and a disclosed customer-data sample substantiate that the breach exposed detailed profiles beyond the contact information initially acknowledged. The account explains the access method, company response and phishing implications, while preserving unresolved questions about scale and the role of the third-party platform.
Source material